How social networks keep your deleted photos

Social networking websites are fast becoming the biggest repository of photographs on the internet - but people who store their pictures online may not be getting what they bargained for.

Users who decide against publishing photos to the rest of the internet usually go through a quick process to delete them: click a button, the picture is gone. But according to research from the University of Cambridge's computer science lab, your deleted photos may continue to exist inside a social network- even when you think they've been erased.

The study, which is detailed here, found that many networks failed to fully delete images: they just hide them away from the user, which makes it appear that the photo had been removed from the system.

One of the paper's authors, Joseph Bonneau, said it showed that many websites were "lazy" when thinking about their users' rights.

"This demonstrates how social networking sites often take a lazy approach to user privacy, doing what's simpler rather than what is correct. It's imperative to view privacy as a design constraint, not a legal add-on."

In an experiment designed to find out how long pictures remained online, the worst culprits were Facebook, MySpace, Bebo, hi5 and LiveJournal - which all failed to fully revoke the images even when a user has deleted them.

A Facebook spokesman said that although the files are erased from the company's servers when a user deletes them, they do not necessarily disappear.

"When a user deletes a photograph from Facebook it is removed from our servers immediately," he said in a statement. "However, URLs to photographs may continue to exist on the Content Delivery Network after users delete them from Facebook, until they are overwritten. Overwriting usually happens after a short period of time, which is why our Statement of Rights and Responsibilities contains the language that it does."

What does this mean? Facebook, and many other large websites, use a so-called Content Delivery Network (CDN) called Akamai that acts as a middle man to send data out across the internet. Although the website might delete the copy of the data it has, removing it from Akamai takes longer. So your photograph exists - and is potentially viewable by the entire internet - until the third party servers update.

However, despite this excuse, not everybody has the same problem. Among the best performing websites Flickr, Photobucket and Google's social networking site Orkut, which all revoked images completely and immediately. Flickr, as far as I know, uses Akamai and Photobucket is owned by Fox (which also owns MySpace).

So why the discrepancy? Deleting images is possible, even if instant deletion isn't cheap. But those who get it right are really thinking about these issues carefully, and working to protect users.

"This experiment is a litmus test of which online services actually believe that you own your personal data," said Jonathan Anderson, one of the paper's other authors.